|
From: Mimi Z. <zo...@li...> - 2014-02-12 14:10:29
|
On Wed, 2014-02-12 at 13:50 +0000, Lipinski, MarekX wrote: > I forgot to mention - I do not use initramfs/initrd. > > Normally it may not make sense to use hash based security without > having initramfs. However the plan is to protect evm-key in different, > platform-specific way. > > Altgough I think hash based IMA/EVM without ram disk is still legal, > isn't it? I guess we'll find out. :) Is there any reason for attempting to load a kernel module, when hmac(sha1) should be built in? We really want to skip the modprobe entirely. Wondering what would happen if the modprobe proc entry was NULL... It looks like the modprobe would be skipped. The last line of crypto/api.c: crypto_larval_lookup() will simply call crypto_larval_add() to add it. thanks, Mimi |